Week in review: Password psychology, SaltStack Salt vulnerabilities exploited, Patch Tuesday forecast
Here’s an overview of some of last week’s most interesting news, articles and podcasts:
SaltStack Salt vulnerabilities actively exploited by attackers, patch ASAP!
Two vulnerabilities in SaltStack Salt, an open-source remote task and configuration management framework, are being actively exploited by attackers, CISA warns.
May 2020 Patch Tuesday forecast: Time for a break?
Threat actor activity around COVID-19 exploitation increased dramatically in April. The US Department of Homeland Security and the UK National Cyber Security Centre issued a joint advisory in early April, warning about this increasing activity. This advisory provides a detailed summary of several attacks and valuable links to actions you can take for mitigation.
GitHub Code Scanning aims to prevent vulnerabilities in open source software
GitHub has made available two new security features for open and private repositories: code scanning (as a GitHub-native experience) and secret scanning.
H2 2019: Duration of phishing attacks grows, use of banking trojans wanes
The lifespan of phishing attacks in H2 2019 has grown considerably and resulted in the tremendous increase in the number of phishing websites blockages, says Group-IB’s Computer Emergency Response Team (CERT-GIB).
Help your helpdesk: Empower employees to self-reset their AD account password
The COVID-19 pandemic has triggered a momentous shift for many organizations: remote work has become the new normal. Businesses that were skeptical before are now being forced to make it work, and many are discovering that the work can be done as well as before, but with significant cost savings.
Half of IT pros believe their cybersecurity teams are ready to detect attacks
A surprising 51 percent of technology professionals and leaders are highly confident that their cybersecurity teams are ready to detect and respond to rising cybersecurity attacks during COVID-19, according to ISACA. Additionally, 59 percent say their cybersecurity team has the necessary tools and resources at home to perform their job effectively.
Password psychology: People aren’t protecting themselves even though they know better
People aren’t protecting themselves from cybersecurity risks even though they know they should, a study on password psychology by LogMeIn reveals.
Why you should be rushing to deploy multi-factor authentication to support remote work
As organizations work to update their technology and infrastructure to support the ever-growing remote workforce, it’s imperative that security isn’t left on the backburner.
How a favicon delivered a web credit card skimmer to victims
Cyber crooks deploying web credit card skimmers on compromised Magento websites have a new trick up their sleeve: favicons that “turn” malicious when victims visit a checkout page.
Phishers target investment brokers, aim for Office, SharePoint login credentials
Phishers are trying to trick investment brokers into sharing their Microsoft Office or SharePoint login credentials by impersonating FINRA, a non-governmental organization that regulates member brokerage firms and exchange markets.
Adult live streaming site CAM4 found leaking data of millions of users
A misconfigured database containing 7 terabytes of sensitive user and company information related to adult live streaming site CAM4 has been found leaking data.
Microsoft announces limited Azure Sphere bug bounty program
Microsoft has announced a new security research / bug bounty program aimed at testing and improving the security of Azure Sphere, its comprehensive IoT security solution.
Nearly a million WordPress sites targeted in extensive attacks
A threat actor is actively trying to insert a backdoor into and compromise WordPress-based sites to redirect visitors to malvertising.
Destination Cyberlandia: 3 keys to cyber happiness amid COVID-19
During this pandemic, cybersecurity teams may be feeling like Cyberlandia is an impossible destination. But I’m here to tell you we can still get there.
Fake Microsoft Teams notification emails are hitting inboxes
Phishers are using fake Microsoft Teams notification emails to trick users into sharing their Microsoft Teams and Office 365 login credentials.
Future of work: Delivering a modern workspace
Whilst we can assume that relocating to a home office will become de-facto for many people over the coming months, remote working needs “bigger picture” thinking with respect to how organizations need to be delivering IT in the future. After all, remote working is only one of the areas that a modern workspace technology delivers.
Helping healthcare combat cyber attackers
Hospitals and other healthcare organizations around the globe are under immense pressure as they test and care for patients with COVID-19. They are also under siege by cyber attackers.
Protecting corporate data in popular cloud-based collaborative apps
While there are plenty of cloud applications available, let’s explore G Suite, Office 365, Salesforce, and Slack, and how organizations can leverage these apps to reap benefits while keeping data safe.
Consumers will opt for competitors after a single ransomware-related service disruption
While most consumers are taking necessary security precautions to protect their online accounts, businesses may not be doing enough to protect their information – inadvertently driving sales to competitors that can, an Arcserve research reveals.
Preventing account takeover and social engineering attacks
Since the COVID-19 outbreak, digital fraud has increased significantly, especially when it comes to account takeover. In this Help Net Security podcast, Angie White, Senior Product Marketing Manager at TransUnion, explores ATO and social engineering attacks and offers some suggestions on how to address these threats.
Despite spending more on compliance, businesses still have basic IT weaknesses
There is a misalignment between data privacy regulation spending and business outcomes, according to Tanium research. Specifically, as businesses spend tens of millions on compliance, over 90 percent have fundamental IT weaknesses that leave them vulnerable and potentially non-compliant.
CCPA privacy requests cost business up to $275k per million consumer records
Organizations who plan on manually processing CCPA data subject requests (DSRs) or data subject access requests will spend between $140k – $275k per million consumer records they have in their systems, according to DataGrail.
How to prevent permission bloat: Overlooked and hidden access
When it comes to your organizational security, you should leave no stone unturned. Overlooked access rights are one of the most unnoticed security threats your organization can face – and it’s less of a stone and more of a somehow-overlooked, but ever-looming mountain.
Most attacks successfully infiltrate production environments without detection
While organizations continue to invest significant budget dollars in security controls and assume that this means assets are fully protected, the reality is that a majority of attacks successfully infiltrate production environments without their knowledge, according to a FireEye report.
How to increase cyber defense agility for the next lockdown
In the current COVID-19 environment, organizations not only face increased exposure to immediate cybersecurity risks, but also challenges in their ability to deploy new or upgraded tools and applications to keep pace with new security threats.
The new cyber risk reality of COVID-19 operating mode
There’s little, if any, precedent for the time we’re experiencing right now with a pandemic changing the corporate landscape in profound ways. But while many are reacting in real-time to the workforce transitioning into the work-from-home-force, in many ways, cybersecurity experts were already developing potential responses despite not knowing the specific circumstances behind this unprecedented global crisis.
Free image transforms Raspberry Pi devices into secure remote work appliances
Remote.it has released a free image for Raspberry Pi devices that transforms the single-board computer into a full-featured remote work appliance.